Pipeline Stage 11

AAGGREGATOR Evaluation

Boolean expression evaluation over all collected attributes

AND & ORBoolean Operators

! PrefixInfrastructure Markers

10+Attribute Sources

O(1)Attr Lookup

SIGNATURE_TYPE_AAGGREGATOR @ 0x10986B3C — SIGNATURE_TYPE_AAGGREGATOREX @ 0x10986E28

The Big Idea

Combine weak signals from ALL prior stages into strong composite detections

Individual signals are often insufficient: a file with suspicious imports is not necessarily malicious. High entropy alone is not proof of packing. An unsigned binary is not inherently dangerous.

But when these signals converge — suspicious imports AND high entropy AND unsigned AND small file size — the combination becomes a reliable detection.

The AAGGREGATOR evaluates boolean expressions over the complete set of attributes collected across Stages 3-10, firing composite detections when multiple conditions align.

// Example AAGGREGATOR expression

// Individual signals (weak):
!SuspiciousImports    // = infra marker
!HighEntropy           // = infra marker
!NotSigned             // = infra marker
!SmallPEFile           // = infra marker

// Combined expression (strong):
!SuspiciousImports &
!HighEntropy &
!NotSigned &
!SmallPEFile
  → Trojan:Win32/Injector.Gen!MTB

Expression Language

Minimal but powerful: AND, OR, NOT, and parentheses over attribute names

Operators

& AND (precedence 2)

| OR (precedence 1)

! NOT / Infra prefix (3)

( ) Grouping

Expression Examples

// Simple AND
HSTR:SusImport & HSTR:HighEntropy

// OR expression
FOP:VirtualAlloc | FOP:VirtualProtect

// Complex nested
(HSTR:PackedUPX | HSTR:PackedASPack)
  & SIGATTR:NotSigned
  & !InfraMarkerCleaner

// Multi-path heuristic
(!PESusImports & !PEHighEntropy)
  | (!ScriptObfuscated & !ScriptEval)
  | (!DocMacro & !DocAutoOpen)

Infrastructure Markers

The ! prefix pattern: building blocks that are never reported as final threats

Stages 3-10 produce !-prefixed detections
!SuspiciousImports, !HighEntropy, !NotSigned

↓

Stage 11 AAGGREGATOR evaluates expression
!SuspiciousImports & !HighEntropy & !NotSigned

↓

Fires: Trojan:Win32/Composite.A
Real detection (no ! prefix)

↓

Stage 13: !-prefixed names FILTERED OUT
Only real detections reach the user

Why Infrastructure Markers?

They solve a fundamental challenge: how do you build multi-factor detections without every intermediate signal being a standalone threat?

// Each of these alone is NOT a threat:
!SuspiciousImports  // many legit apps
!HighEntropy         // compressed data
!NotSigned           // most freeware
!SmallPEFile         // plenty of tools

// But ALL together = reliable detection
!SuspiciousImports &
!HighEntropy &
!NotSigned &
!SmallPEFile
  = Trojan:Win32/Injector.Gen

Attribute Sources

The AAGGREGATOR consumes attributes from ALL prior pipeline stages

Stage 3: HSTR HSTR:PatternName

Stage 3: PEHSTR PEHSTR:PatternName

Stage 4: SIGATTR SIGATTR:AttrName

Stage 5: FOP FOP:BehaviorName

Stage 5: TUNNEL TUNNEL:ApiName

Stage 5: THREAD THREAD:Observation

Stage 9: BRUTE BRUTE:PatternName

Stage 10: Lua mp.setattribute()

All attributes stored in HashSet<String> O(1) lookup per attribute — microsecond evaluation

AAGGREGATOR vs AAGGREGATOREX

Two signature types: standard boolean evaluation and extended capabilities

SIGNATURE_TYPE_AAGGREGATOR

@ 0x10986B3C

// Standard boolean expression
Expression: "!A & !B & HSTR:X"
Operators:  AND, OR, NOT, ( )
Eval:      boolean result
Output:    fire or skip

SIGNATURE_TYPE_AAGGREGATOREX

@ 0x10986E28

// Extended expression capabilities
Expression: extended boolean
Operators:  AND, OR, NOT, ( )
+ Weighted: score per attribute
+ Threshold: fire at score >= N
+ Context:  scan-context-aware

Both types are loaded from the VDM database and evaluated against the same attribute set. AAGGREGATOREX adds scoring and context-dependent logic.

Expression Parser

Recursive descent parser with short-circuit evaluation

// Reconstructed from decompilation

fn evaluate(expr: &str, attrs: &HashSet<String>) -> bool {
    parse_or(&mut Parser::new(expr), attrs)
}

fn parse_or(p: &mut Parser, attrs: &HashSet) -> bool {
    let mut left = parse_and(p, attrs);
    while p.peek() == '|' {
        p.advance();
        left = left || parse_and(p, attrs);  // short-circuit!
    }
    left
}

fn parse_and(p: &mut Parser, attrs: &HashSet) -> bool {
    let mut left = parse_primary(p, attrs);
    while p.peek() == '&' {
        p.advance();
        left = left && parse_primary(p, attrs); // short-circuit!
    }
    left
}

fn parse_primary(p: &mut Parser, attrs: &HashSet) -> bool {
    if p.peek() == '(' { /* grouped */ }
    if p.peek() == '!' {
        let name = p.read_name(); // includes ! prefix
        return attrs.contains(&format!("!{}", name));
    }
    attrs.contains(p.read_name())
}

Detection Engineering Workflow

How analysts create composite detections without changing the engine binary

1 Analyze Sample Identify N behavioral indicators specific to malware family

2 Create Infra Markers Write HSTR/PEHSTR/Lua sigs producing !MalFamily_IndicatorX attributes

3 Write AAGGREGATOR Create boolean expression: !Ind_A & !Ind_B & (!Ind_C | !Ind_D)

4 Assign Threat Name Map expression to Trojan:Win32/MalFamily.Gen!MTB

5 Ship via VDM Deploy globally in hours — no engine binary change needed

Turnaround time from analysis to global deployment: hours, not weeks

Key Takeaways

Composite Detection

Evaluates boolean expressions over attributes from all 10 prior stages. Weak signals become strong composite detections.

Infrastructure Markers

!-prefixed detections are building blocks, never reported to users. Filtered out in Stage 13 verdict resolution.

Microsecond Evaluation

HashSet lookup is O(1). Short-circuit evaluation. Single-pass parsing. Thousands of expressions evaluated in microseconds.

VDM Deployable

New AAGGREGATOR rules ship via signature updates. Hours from analysis to global detection without engine changes.

All data from reverse engineering mpengine.dll v1.1.24120.x